sanitize-html vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113650Mediumsanitize-html: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not…CVE-2026-113657Lowsanitize-html: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)CVE-2026-113661Mediumsanitize-html: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsCVE-2026-113654Mediumsanitize-html: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderCVE-2026-63670Mediumsanitize-html: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closeCVE-2026-84371Mediumsanitize-html: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypassCVE-2026-53606Mediumsanitize-html: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background…CVE-2026-44990Criticalsanitize-html: Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-40186Mediumsanitize-html: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags ElementsCVE-2019-25225Mediumsanitize-html: sanitize-html is vulnerable to XSS through incomprehensive sanitizationCVE-2024-21501Mediumsanitize-html: sanitize-html Information Exposure vulnerabilityCVE-2022-25887Highsanitize-html: Sanitize-html Vulnerable To REDoS AttacksCVE-2021-26540Mediumsanitize-html: Improper Input Validation in sanitize-htmlCVE-2021-26539Mediumsanitize-html: Improper Input Validation in sanitize-htmlCVE-2016-1000237Mediumsanitize-html: Cross-Site Scripting in sanitize-htmlCVE-2017-16016Mediumsanitize-html: Cross-Site Scripting in sanitize-htmlCVE-2017-16017Mediumsanitize-html: Cross-Site Scripting in sanitize-html

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo